Privacy Policy
Version: September 2026

This English version is a courtesy translation provided for convenience. Only the German version is legally binding.

Thank you for your interest in our company. The protection of your data is our highest priority. In general, you can use our website second-view.eu without providing any personal data. However, if you wish to use certain services via our website, it may be necessary for us to process personal data. In cases where there is no legal basis for such processing, we always obtain your express consent in advance.

1. Controller pursuant to Art. 4 No. 7 GDPR

Q-Rad GmbH, represented by Dr. med. Igor Toker
E-mail: igor.toker@q-rad.de

2. Structure of our services

Second-View.eu consists of two separate areas:

• Information/marketing site (static website — Hetzner, Germany)
  – provision of general information
  – no cookies, no tracking
  – processing of technical access data only (server logs)
• Medical portal (uploader & report area — Hetzner, Germany)
  – submission of medical documents
  – preparation and provision of the medical second opinion
  – payment via Stripe

Medical data is processed exclusively in Germany.

3. Purposes of data processing

We process your data for the following purposes:

• responding to your inquiry
• reviewing the inquiry and creating a user account
• transmitting your medical documents to the selected specialist physician
• preparing and providing the medical second opinion
• payment processing via Stripe
• ensuring the technical operation and security of the platform
• obtaining voluntary user feedback for quality assurance and improvement of our services (satisfaction surveys after case completion; where applicable, an invitation to submit a public review)

4. Legal bases for processing

Processing is carried out on the basis of:

Art. 6 (1) (b) GDPR

Performance of (pre-)contractual services in connection with the medical second opinion.

Art. 6 (1) (a) GDPR & Art. 9 (2) (a) GDPR

Express consent to the processing of medical data.

Art. 6 (1) (f) GDPR

Legitimate interest in

- the secure provision of the platform and

- obtaining user feedback for quality assurance and improvement of our services (satisfaction surveys after case completion, where applicable an invitation to submit a public review).

We send feedback requests exclusively to users after completion of their case. You can object to this processing at any time with effect for the future (Art. 21 GDPR) — informally, by e-mail to the address stated in Section 1. After an objection, we will not send you any further feedback requests.

Art. 9 (3) GDPR

Processing by members of a health profession subject to professional secrecy (specialist physicians).

Consent may be withdrawn at any time (with effect for the future).

5. Categories of data processed

5.1 Contact and communication data

• e-mail address
• contents of the contact form
• metadata (IP address, time)

5.2 Medical data (Art. 9 GDPR)

• medical history, free-text entries
• reports, physician letters
• DICOM/image data
• documents in the upload portal
• the medical second opinion

5.3 Payment data

• amount
• payment status
• Stripe transaction ID
  (No health data is shared with Stripe)

5.4 Feedback and survey data

- information from voluntary satisfaction surveys (ratings, free-text comments)

- e-mail address (for the invitation)

- technical metadata (IP address, user agent, time)
(No health data; participation is voluntary.)

6. Recipients and categories of service providers

Data is shared only to the extent necessary for the service.

6.1 Specialist physicians

Receive medical documents exclusively for the preparation of the second opinion.
Act as independently responsible treating physicians.

6.2 Hetzner (Germany)

Hetzner Online GmbH
Operates:

• this website (information/marketing site; technical access data only in server log files: IP address, time, page accessed, user agent)
• the medical portal
• the database
• the storage for medical documents

Processing takes place exclusively in Germany.

6.3 Resend (USA)

E-mail service for notifications.
Processes:

• e-mail addresses
• technical delivery logs

Safeguard: SCCs.
No medical data is transmitted.

6.4 Stripe Payments Europe Ltd. (Ireland) & Stripe Inc. (USA)

Payment processing, including transmission of the payment data required.
Safeguarded by SCCs.

Stripe receives no medical data.

7. Data security

We implement technical and organizational measures pursuant to Art. 32 GDPR, including:

• TLS/HTTPS encryption
• access restrictions based on the “need-to-know” principle
• token-based login (“magic links”) for specialist physicians
• password-protected admin access
• encrypted storage of all data (Hetzner, Germany)
• regular backups
• server operation in ISO 27001-certified data centers

Medical data is stored exclusively in Germany.

8. Retention and deletion

8.1 Storage by the platform (Q-Rad GmbH)

We store medical data only for as long as is necessary for the preparation and provision of the medical second opinion.

After completion of the case:

• medical documents are deleted within 30 days,
• canceled or rejected cases are deleted within 7 days.
• Feedback and survey data is deleted together with the associated case (no later than 30 days after completion).

We are not subject to any statutory medical retention obligation, as we do not provide medical services.

8.2 Retention by the physicians

The consulted specialist physicians are, as treating physicians, obliged to retain their medical documentation (e.g. the second opinion prepared and essential information)
for 10 years (Section 630f of the German Civil Code (BGB)).
This retention does not take place via the platform but in the physician's own medical records.

9. Your rights as a data subject

Under the GDPR, you have the right at any time to:

• access (Art. 15)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• withdrawal of consent (Art. 7 (3))
• objection (Art. 21)

Supervisory authority for data protection complaints

You may contact any data protection authority, e.g.:

the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)
or the authority of your EU country of residence.

10. Automated decision-making

No automated decision-making or profiling pursuant to Art. 22 GDPR takes place.

11. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy as needed.
The current version is available on the website at any time.